ExecBro

Navigate the app's router directly, and verify it actually moved. PURPOSE: Jump to a screen without tapping through the UI, with a settled before/after route check. WHY THIS EXISTS: hand-written router calls report success whenever nothing throws. A path sent to a React Navigation ref changes nothing and warns only in LogBox, so a no-op reads as a success. DESTINATIONS ARE NOT INTERCHANGEABLE: Expo Router takes paths ("/event-details?id=1"); React Navigation takes route names ("TarotNav"). The response reports which router resolved. Unknown React Navigation names are rejected before dispatch, with nearest-match suggestions. WORKFLOW: navigate({ to: "/settings" }) -> check changed -> get_screen_state. LIMITATIONS: push/replace are unavailable on a React Navigation root ref (stack-scoped). changed=false means it settled without moving; indeterminate=true means no settled reading. DISCOVERY: navigate({ routeTable: true }) with no destination just LISTS the registered route names — call it first when you do not know them. NATIVE ANDROID: on an app with execbro-sdk-android, drives its Jetpack Navigation NavController. to is a route pattern ("settings", "detail/{id}") and params fill its placeholders. GOOD: navigate({ to: "TarotNav" }); navigate({ action: "back" }); navigate({ routeTable: true }) BAD: navigate({ to: "/TarotNav" }) on React Navigation — that is a path, not a route name.

Simulate offline or slow network for the running app. PURPOSE: Reach the offline / timeout branches through the app's real code. WHEN TO USE: 'what does this screen do with no network', 'is there a loading state', 'does the retry banner appear'. WORKFLOW: network_condition({mode:"offline"}) -> reproduce -> network_condition({mode:"normal"}). OFFLINE also patches NetInfo when installed, because many apps gate their offline UI on useNetInfo() rather than on a failed request. The result reports netInfo as patched / reads-patched-only / not-installed. Request failure works regardless. LIMITATIONS: JS-originated HTTP only. Does not change the device's real connectivity. Leaves network_mock rules untouched. GOOD: network_condition({mode:"slow", latencyMs:3000}) BAD: forgetting network_condition({mode:"normal"}) afterwards — it survives reload_app.

Intercept the app's HTTP requests and replace or modify the response. PURPOSE: Drive the app down an error path through its REAL code — the request builder, the error branch, the retry, the toast. redux_dispatch writes the post-failure state directly and skips all of it. WHEN TO USE: 'what does this screen do on a 500', 'what if this field is null', 'does the retry work'. WORKFLOW: network_mock({action:"add", url:"/orders", status:500}) -> reproduce -> get_network_requests (rows show [MOCK m1]) -> network_mock({action:"clear"}). MODES: replace returns a canned response; tamper fetches the real one and mutates it (set/remove take dotted paths). MATCHING: url is a substring by default; wrap it in slashes for a regex ("/\\/orders\\/\\d+$/"). First matching rule wins, so add specific rules before broad ones. GRAPHQL: every operation shares one URL, so add operation:"GetUser" to match one operation by name (operationName in the body, the name in the query document, or operationName in a GET URL). url is optional then. Batched array bodies are not matched. LIMITATIONS: JS-originated HTTP only — native-module traffic (native SDKs, <Image> loading) is not intercepted. Rules are per-device and survive reload_app; clear them when done (a bare clear covers every device). GOOD: network_mock({action:"add", url:"/orders", mode:"tamper", remove:["data.email"]}) BAD: leaving a rule active and then debugging why the app 'always fails' — check network_mock({action:"list"}) hit counts first.

Re-issue a request the app already made, optionally with changes. PURPOSE: Retry a captured call without driving the UI back to the screen that made it — and vary one field at a time to find what the backend actually rejects. WHEN TO USE: A request 4xx'd and you want to know whether it was the body, a header, or the endpoint. Or a flaky call you want to run again. WORKFLOW: get_network_requests -> copy the id -> network_replay({requestId:"js-x1-7"}) -> network_replay({requestId:"js-x1-7", body:"{...}"}). GOES THROUGH THE APP: same network stack, TLS trust, proxy and credentials as the original — cookies are attached by the native cookie jar, so a cookie-authenticated call replays as the logged-in user with no token handling. An active network_mock rule will intercept the replay too; the response says so when it does. LIMITATIONS: ids come from get_network_requests and expire when the buffer rolls over or clear_network runs. Headers replace wholesale, they do not merge. GOOD: network_replay({requestId:"js-x1-7", body:"{\"qty\":99}"}) BAD: guessing a requestId — read one from get_network_requests first.

Pinch-to-zoom using REAL two-finger touch events, with pixel-diff verification. ANDROID EMULATOR ONLY (iOS in progress). [PRIMARY INTERACTION TOOL — works on iOS and Android; prefer over ios_*/android_* siblings] PURPOSE: Zoom a map, image gallery, photo viewer, or any zoomable surface. pinch({ direction: "out" }) zooms in at screen centre; "in" zooms out. Pass x/y to zoom around a specific point. HOW IT WORKS: Two independent contacts sent through the emulator's multi-touch bridge as real kernel touch events. It works below the app, so it drives React Native, native views, WebViews — anything on screen. VERIFICATION: verify=true (default) returns `verification.meaningful` — false means nothing zoomed (not zoomable, already at a zoom limit, or the focal point missed). WORKFLOW: pinch({ direction: "out" }) -> read verification.meaningful. Take x/y from get_screen_state or a screenshot; no conversion needed. IF A GESTURE DOES NOTHING: lower `span` — the contacts may be landing on surrounding UI (a top bar, a bottom sheet) rather than the zoomable surface. direction="in" already defaults to a reduced span for this reason. LIMITATIONS: Physical Android devices and iOS have no multi-touch channel and return an explicit error, never a partial result. Success means real fingers moved — this never fakes zoom by calling app code.

Press a keyboard key or shortcut in the focused element: Enter, Escape, Tab, arrows, Backspace, or a combo like Shift+Tab / Meta+K. PURPOSE: Keys that are not text: submit with Enter, close a dialog with Escape, move focus with Tab, walk a list with arrows, delete with Backspace. WHEN TO USE: After input_text, or on any focused element. Pass testID or text to focus a target first; otherwise the key goes to whatever has focus. For typing text use input_text. PLATFORMS: chromium (Electron / Chrome) sends real key events through CDP and reports the focused element before and after. Android sends adb keyevents (no modifier combos). iOS simulator sends HID keys through AXe or IDB (combos need AXe); a physical iPhone is not supported. WORKFLOW: input_text({ testID, text }) -> press_key({ key: "Enter" }). GOOD: press_key({ key: "Backspace", repeat: 3 }) GOOD: press_key({ key: "Meta+K", device: "FluentTalk" }) BAD: press_key({ key: "hello" }) - text is input_text's job.

Dispatch a Redux action to the store bound to the app's <Provider>, triggering useSelector subscribers and React re-renders. Resolves the live store by walking the React fiber tree on each call (no SDK setup needed; works even if no store was registered with init()). PURPOSE: Drive state-controlled UI (loaders, modals, toasts, error overlays) without exercising the real flow (network, OTP, etc.). WHY THIS EXISTS: __RN_AI_DEVTOOLS__.stores.redux often holds a different store reference than the one passed to <Provider>, so dispatching through it updates state but does NOT notify react-redux subscribers. This tool dispatches through the actual Provider store, so views re-render. WHEN TO USE: Verify state-driven UI by seeding redux state directly. Example: dispatch app/setIsLoading: true, then screenshot to confirm the loader rendered. WORKFLOW: redux_dispatch({ action: { type: 'app/setIsLoading', payload: true } }) -> screenshot -> redux_dispatch({ action: { type: 'app/setIsLoading', payload: false } }). BATCH: action accepts an array — dispatched in order, one round trip. LIMITATIONS: Requires React DevTools hook (dev mode). Action must be plain JSON-serializable (no thunks/functions). If the app has multiple <Provider> roots, pass storeIndex (default 0). GOOD: redux_dispatch({ action: { type: 'app/setIsLoading', payload: true } }) BAD: redux_dispatch({ action: () => ... }) — actions must be plain objects; for thunks use execute_in_app to call your action creator.

Read state from the Redux store bound to the app's <Provider>, resolved live via the fiber tree (same store redux_dispatch targets). PURPOSE: Inspect the current app state without relying on __RN_AI_DEVTOOLS__.stores.redux (which may point at a different store instance than the Provider). WHEN TO USE: Verify state shape before/after redux_dispatch, or check what slice keys exist before crafting an action. WORKFLOW: redux_get_state() -> craft action -> redux_dispatch -> redux_get_state({ path: 'app' }) to confirm. SHAPE FIRST: a large state comes back as its structure — every key path kept, arrays and objects annotated with real sizes, leaves clipped. Read it, then narrow. NARROWING, TWO WAYS: path drills IN THE APP, so the rest of the state never crosses the wire — prefer it when you know the slice. query runs here and adds [0], [-1], [*] and quoted keys. They compose: path picks the slice, query picks the field inside it. LIMITATIONS: Requires React DevTools hook (dev mode). State must be JSON-serializable; non-serializable values are replaced with an error marker. GOOD: redux_get_state({ path: 'app' }) | redux_get_state({ path: 'cart', query: 'items[*].sku' }) BAD: redux_get_state({ path: 'app.isLoading.0' }) when isLoading is a boolean — path traversal returns undefined.

Reload the React Native app (triggers JavaScript bundle reload like pressing 'r' in Metro). PURPOSE: Force a full JS bundle reload when Fast Refresh isn't enough — clears in-memory state and re-runs the bundle from scratch. WHEN TO USE (only these cases): (1) native code, app.json, Info.plist, Podfile, or a native module changed; (2) Fast Refresh visibly failed (red-screen or stale render confirmed via screenshot after a few seconds); (3) the app is in a broken state; (4) you need to reset app state completely; (5) the user explicitly asks. AVOID: reloading reflexively after JS/TS/TSX/style edits — Fast Refresh applies those in 1-2s. A reload discards navigation stack, context, hooks state, BLE/WebSocket connections, paired devices, and auth sessions, which can force re-pairing or re-login and break your verification loop. WORKFLOW: screenshot → wait 2s for Fast Refresh → if still stale, reload_app. Auto-connects to Metro if no connection exists (with or without a device argument) — no need to call scan_metro first. After reload, wait a few seconds before running other tools. SEE ALSO: get_refresh_status (did Fast Refresh accept?), get_bundle_status (did Metro compile?).

Run a named command that a native Android app registered with execbro-sdk-android (ExecBro.init { command("name") { ... } }). PURPOSE: Drive app behaviour (lock, log out, reset state, seed data) through actions the app's developer exposed, without tapping through the UI. The native counterpart of calling a store action with execute_in_app. WORKFLOW: list_debug_globals (lists commands) -> run_app_command({ name }) -> inspect_global to confirm the state changed. Call with no name to list the commands. LIMITATIONS: Native Android apps with execbro-sdk-android only. Commands run on the app's main thread with a 5 s limit. GOOD: run_app_command({ name: "lock" }); run_app_command({ name: "seed", args: { users: 3 } }) BAD: run_app_command on a React Native app: use execute_in_app there.

Discover and connect to debuggable apps: React Native via Metro, Chromium/Electron via CDP, and native Android apps that include execbro-sdk-android. This is typically the FIRST tool to call when starting a debugging session - it establishes the connection needed for other tools like get_logs, list_debug_globals, execute_in_app, and reload_app. PURPOSE: Discover Metro on ports 8081-8090 and auto-connect every React Native debugger target it advertises. Also probes Chromium debug ports: 9222 is listed but not auto-connected (attach with connect_metro), ports in EXECBRO_CHROMIUM_PORTS auto-connect. NATIVE ANDROID: also finds native apps that include execbro-sdk-android on every online adb device and connects them (runtime native). WHEN TO USE: At the start of any session, or after the user restarts Metro / boots a new simulator. WORKFLOW: scan_metro -> get_apps -> get_logs / screenshot / tap. GOOD: scan_metro() BAD: scan_metro() called repeatedly in a loop — use ensure_connection to re-verify an existing connection.

Take a screenshot of whichever target `device` resolves to: iOS simulator, USB-attached iPhone/iPad, Android device/emulator, or chromium (Electron / Chrome) window. Returns the image plus a screen-state summary: active route, overlay-grouped tappable elements (pressables behind an open sheet/modal excluded), component names as JSX tags, labels, testIDs and frames in ready-to-tap pixel coordinates. Use component names for inspect_component/find_components. PURPOSE: The capture tool for every platform. See what the user sees AND get tap-ready pressables in one call. WHEN TO USE: Visual verification, before/after comparison, or the starting point for tapping by coordinates. WORKFLOW: screenshot -> pick a pressable -> tap(text=...) if exact and unique, else tap(x, y) -> screenshot to verify. COORDINATES: image pixels are the coordinates tap(x, y) takes, on every platform. Never scale them yourself. PHYSICAL iOS: pass the UDID or name from list_devices. Capture only: no pressables, no tap/swipe/input_text. LIMITATIONS: a hidden or minimised chromium window cannot be captured: the call fails at once and says so. GOOD: screenshot(); screenshot({ device: "FluentTalk" }) BAD: a made-up device name or UDID, run list_devices first. SOURCE: inspect_at_point(x, y) maps a pixel to the file and line that renders it.

Search console logs for text (case-insensitive). PURPOSE: Find log lines matching a substring across the connected app's console buffer. WHEN TO USE: User reports a known error/warning, or wants to trace a specific event (e.g., "redux", "auth failed"). For unfocused exploration, prefer get_logs. WORKFLOW: scan_metro -> search_logs(text="...") -> if empty, get_logs to verify buffer populated. LIMITATIONS: Only matches text captured AFTER the app connected; won't find pre-connect logs. GOOD: search_logs({ text: "TypeError" }) BAD: search_logs({ text: "" }) (use get_logs for a raw dump)

Search network requests by URL pattern (case-insensitive). PURPOSE: Filter the network buffer to requests whose URL matches a substring — fast way to find a specific endpoint in a noisy app. WHEN TO USE: You know part of the URL (e.g., "/graphql", "users", a domain) and want matching requests across all devices. WORKFLOW: search_network(urlPattern="/api/") -> get_request_details(requestId="...") for full headers/body. LIMITATIONS: Matches URL only; for method/status/body filtering use get_network_requests. Bodies are only present when the SDK is installed. GOOD: search_network({ urlPattern: "/graphql" }) BAD: search_network({ urlPattern: "" }) — empty pattern matches everything; use get_network_requests instead.

Report feedback about the ExecBro MCP tools THEMSELVES — a tool (tap, get_screen_layout, get_logs, etc.) that behaved incorrectly, was confusing, was missing, or could work better. This is EXCLUSIVELY about your experience operating ExecBro's debugging tools. It is NOT for bugs in the user's app under test, and NOT for the feature or task you were working on in this session — keep that out of the report entirely. Auto-collects environment info. Returns a pre-filled GitHub issue URL and formatted issue body. Ask the user to open the URL and paste the body to submit.

Swipe gesture that auto-routes to the correct platform (iOS or Android), with pixel-diff verification. [PRIMARY INTERACTION TOOL — works on iOS and Android; prefer over ios_*/android_* siblings] PURPOSE: Single unified swipe entry point. Easiest form: swipe({ direction: "up" }) scrolls to reveal more content ("down"/"left"/"right" also work; bare swipe() defaults to "up"). Optional distance in screenshot pixels (default 33% of axis). For precise control, pass all four coordinates (startX/startY/endX/endY) — they take precedence over direction. WHEN TO USE: Scrolling lists, paging carousels, pull-to-refresh, dismissing sheets, opening drawers. Especially useful in virtualized lists (FlatList/SectionList) where off-screen items aren't mounted in the fiber tree. VERIFICATION: verify=true (default) returns `verification.meaningful`. When false, `warning` names the cause — already at top/end, not scrollable, wrong axis, no scroll view there, or (no RN connection) that it could not inspect the screen. burst=true catches transient feedback like overscroll bounce. SAFETY: Android direction swipes stay clear of the system bars; `foregroundLost` appears if the app left the foreground anyway. WORKFLOW: swipe({ direction: "up" }) -> read response.verification.meaningful. CHROMIUM: a direction is a mouse wheel (reports `scrolled`), four coordinates a drag. LIMITATIONS: iOS needs AXe (brew install cameroncooke/axe/axe) or IDB. Pass `device` to pick one (list_devices).

Tap a UI element. Automatically tries multiple strategies: fiber tree (React), accessibility tree (native), and OCR (visual). [PRIMARY INTERACTION TOOL — works on iOS and Android; prefer over ios_*/android_* siblings] PURPOSE: Single unified tap entry point — resolves text/testID/component/coordinates into a real touch event on the correct device. WHEN TO USE: Any time you need to press a button, focus an input, open a menu, or verify a handler fires. Prefer testID, then text, then component, then (x,y) from a screenshot's pressables list. WORKFLOW: screenshot -> tap(testID="...") | tap(text="...") | tap(x, y) -> screenshot again to verify. Use burst=true when meaningful=false but visual feedback looks transient. LIMITATIONS: iOS needs AXe (brew install cameroncooke/axe/axe) or IDB for accessibility/coordinate taps. Non-ASCII text skips fiber (Hermes); prefer testID. Pass `device` to target a specific simulator/emulator when multiple are available — call list_devices for the inventory. GOOD: tap({ testID: "login-btn" }); tap({ text: "Submit" }); tap({ x: 300, y: 600 }); tap({ x: 300, y: 600, native: true, device: "emulator-5554" }) LONG PRESS: tap({ testID: "row-3", duration: 800 }) holds the touch. CHROMIUM: testID matches data-testid/id; clicks via CDP. BAD: tap({ text: "" }) or tap({ x: 0, y: 0 }) — missing a target. tap({ text: "Submit" }) without first screenshotting an ambiguous screen. SOURCE: need the file:line that renders an element? inspect_at_point(x, y).

Read a credential out of the running app straight into the vault. The value is never returned to you. PURPOSE: Cover credentials no captured request revealed — a cold session before the app has made an authenticated call, a token the app refreshed in the background, or one held somewhere no heuristic finds (keychain, expo-secure-store, an Apollo link). WHEN TO USE: http_request says no credential is known for an origin, or list_secrets shows the entry as EXPIRED after a re-login. WORKFLOW: vault_capture({ expression: "SecureStore.getItemAsync('access_token')", origin: "https://api.acme.io" }) -> http_request({ ..., auth: { secret: "api.acme.io" } }). GOOD: vault_capture({ expression: "store.getState().auth.token", origin: "https://api.acme.io" }) BAD: reading the same value with execute_in_app — that returns it into the transcript, permanently.